272026 matches found
CVE-2026-85610
OpenPanel before version 2.3.0 is vulnerable to Remote Code Execution via chart formula expressions. The root cause is improper validation of these expressions, which allows authenticated project members with read access to recover the native JavaScript Function constructor through mathjs matrix ...
CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter
Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...
CVE-2026-85604
Grav before 2.0.19 (versions ≤ 2.0.17) is vulnerable to remote code execution via the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, allowing a plain function name to pass the sandbox—unlike |map, |filter, and |reduce. The denylist miss...
CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter
Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE...
CVE-2026-82923
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
EUVD-2026-70990
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
GHSA-2FJV-4HM5-6J23 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-8H5Q-977G-XQF2 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-F4FR-6HPC-V792 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-5FQ4-CF4M-H32G vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-859R-QGH9-2MWV vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-5724-75RM-8CXV vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-P67G-9RGF-JJH6 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-M4C2-Q6HR-P6W3 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-XM9J-86VV-2J8R vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-XRMP-96P2-C668 vulnerabilities
Vulnerabilities for packages: chromium...